fc403f41e7707d01d41933760ef870483042fa736d1144880a8c9fda3d6240ed

Analysis

max time kernel
133s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 22:14

Target

0e5b7f563974e31922f5d067699735e0_NeikiAnalytics.exe
Size

223KB
MD5

0e5b7f563974e31922f5d067699735e0
SHA1

fd6e076f4178b4ddfaf1976262f97a9c58c745d2
SHA256

fc403f41e7707d01d41933760ef870483042fa736d1144880a8c9fda3d6240ed
SHA512

4d7eabe286ecbe49cc090d1263c2219d4b0bd04971140d18dc353ca8f14533a3910d2305a8b4faefe4bd1bea3a0097e2579e0c425f8ce15f530f43d420819002
SSDEEP

3072:Sb22PbVHW0lR4J+f45FowYPO3GBjL8WZesep8TaC+n4ZOB62JHI3GYZjueXVihP:p2PbLuWyrseXCW4uJoLWP

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4616	0e5b7f563974e31922f5d067699735e0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4616	0e5b7f563974e31922f5d067699735e0_NeikiAnalytics.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1888	416	WerFault.exe	81
1428	4616	WerFault.exe	88

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
416	0e5b7f563974e31922f5d067699735e0_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4616	0e5b7f563974e31922f5d067699735e0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 416 wrote to memory of 4616	416	0e5b7f563974e31922f5d067699735e0_NeikiAnalytics.exe	88
PID 416 wrote to memory of 4616	416	0e5b7f563974e31922f5d067699735e0_NeikiAnalytics.exe	88
PID 416 wrote to memory of 4616	416	0e5b7f563974e31922f5d067699735e0_NeikiAnalytics.exe	88

C:\Users\Admin\AppData\Local\Temp\0e5b7f563974e31922f5d067699735e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0e5b7f563974e31922f5d067699735e0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 396
  2⤵
  - Program crash
  PID:1888
- C:\Users\Admin\AppData\Local\Temp\0e5b7f563974e31922f5d067699735e0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\0e5b7f563974e31922f5d067699735e0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 364
    3⤵
    - Program crash
    PID:1428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 416 -ip 416
1⤵
PID:2956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4616 -ip 4616
1⤵
PID:3460

C:\Users\Admin\AppData\Local\Temp\0e5b7f563974e31922f5d067699735e0_NeikiAnalytics.exe

Filesize
223KB

MD5
4e6efa17849a49273e4062148e02084a

SHA1
d6f5dd44623f69a81a9eb8914964fb8ed6f86619

SHA256
67e31d03e2f22a1cd0f0f75ca7284fd668f61834f66d969df98837c2dfc9696c

SHA512
8b5d2e50953b1a671723db1738cbacfffb83ff0c286a466d949fbe6b11948f3b39c186e973ec7a9893e7327ee8a0d6e97298e38769d72690a25548a2631fe123

Download Submit
memory/416-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/416-6-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4616-7-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4616-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4616-13-0x0000000004D50000-0x0000000004D96000-memory.dmp

Filesize
280KB

Download
memory/4616-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download